Is it impossible to combine the results of a normal search and threshold search in a single table

[shellnight]

Is there any way the results of a normal search and threshold search can be combine and displayed in a single table on the dashboard ?

The data i have is just 2 fields . Machine name and its problem

machine1 - disk failure
machine2 - virus failure
machine 3 - cpu utlization 15%
machine4 0- cpyu utlization 80%
machine5 - ram crash

I want the results to be displayed as below ignoring the machine with CPU with 15% utlization and only display machine with cpu utlization higher than 50%

So the results of the table should be :

machine1 - disk failure
machine2 - virus failure
machine4 0- cpyu utlization 80%
machine5 - ram crash

[fdi01]

you said that: "The data i have is just 2 fields . Machine name and its problem"
i call Machine name field ----->>> Machine_name
and problem field ----->>> machine_problem
then try like:

your search producing   | stats list(eval(machine_problem!="cpu utlization 15%")) as list_of_machine_problem by Machine_name

[shellnight]

I am afraid you are not understanding the request.

I need the list of all problems in machine but exclude the occurences for cpu utlization less than 50

[ppablo]

Hi @shellnight

Please be sure that when responding to someone's answer, click on "Add comment" directly below their answer or, if responding to someone's comment, type in the "Add your comment..." box directly below their comment. You keep typing your responses in the "Enter your answer here..." box at the very bottom of the page which, instead, posts a brand new answer when it was really meant as a comment. This will help with a clean continuous flow of the conversation. It gets especially confusing when there are multiple answers on your post and people have no idea who you're responding to. I already converted your "answers" to comments, so just something to keep in mind from here on out.

[shellnight]

^^ hi fdi01 , I dont see any mention CPU utlization in the query that you have provided above . Please note that i need to see all other event types + the ones where CPU is higher than 50%

The table should look like this

machine1 - disk failure
machine2 - virus failure
machine4 0- cpu utlization 80
machine5 - ram crash

[fdi01]

hello Mr shellnight covert your answer in text comment.
to do it covert your answer in comment.

and to search where the count is higher than 50 for cpu utlization
try this:

your search producing   |table *| where count >50

[shellnight]

hi fdi01 , I dont see any mention CPU utlization in the query that you have provided above . Please note that i need to see all other event types + the ones where CPU is higher than 50%

The table should look like this

machine1 - disk failure
machine2 - virus failure
machine4 0- cpu utlization 80
machine5 - ram crash

shellnight · 17 hours ago
I am afraid you are not understanding the request.

I need the list of all problems in machine but exclude the occurences for cpu utlization less than 50

[shellnight]

Sorry ,A correction is required . There are 3 fields

Machine name
problem type
Count

i need the list of machine where the count is higher than 50 for cpu utlization along with normal search

[gyslainlatsa]

hi shellnight,

your search producing   | where machine != machine3

or

    your search producing   | where machine != "machine3"

[shellnight]

its not just about machine3 , the purpose of the search is to exclude all those results which have cpu utlization less than 50%